build: publish npm prereleases from tags with trusted publishing

.github/workflows/ci.yml

@@ -25,12 +25,15 @@ jobs:
 
   run-tests:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: [20, 22]
     steps:
       - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: ${{ matrix.node }}
           cache: yarn
           cache-dependency-path: yarn.lock
 
@@ -40,6 +43,12 @@ jobs:
       - name: Run tests
         run: yarn test
 
+      - name: Check publishable tarballs
+        run: yarn tsx bin/check-tarballs.ts
+
+      - name: Smoke-test installed tarballs
+        run: yarn tsx bin/smoke-tarballs.ts
+
   build-web:
     runs-on: ubuntu-latest
     steps:

.github/workflows/publish.yml

@@ -0,0 +1,70 @@
+name: Publish tagged packages
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Run npm publish with --dry-run"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  id-token: write
+
+# lerna.json sets no commit message; adding "[skip ci]" there would
+# silently stop this workflow from publishing.
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    outputs:
+      tagged: ${{ steps.tags.outputs.tagged }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - id: tags
+        run: |
+          if git tag --points-at HEAD | grep -q '^@ethdebug/'; then
+            echo tagged=true >> "$GITHUB_OUTPUT"
+          else
+            echo tagged=false >> "$GITHUB_OUTPUT"
+          fi
+
+  publish:
+    needs: check
+    if: >-
+      needs.check.outputs.tagged == 'true' ||
+      github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    concurrency:
+      group: publish
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: yarn
+          cache-dependency-path: yarn.lock
+
+      - name: Use npm 11 (trusted publishing)
+        run: npm install -g npm@11
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Run tests
+        run: yarn test
+
+      - name: Publish
+        run: >-
+          yarn tsx bin/publish-tagged.ts
+          ${{ (github.event_name == 'workflow_dispatch' && inputs.dry-run) && '--dry-run' || '' }}

.gitignore

@@ -3,3 +3,4 @@ dist/
 *.tsbuildinfo
 coverage/
 .worktrees/
+.nx/

bin/check-tarballs.ts

@@ -0,0 +1,23 @@
+import { fileURLToPath } from "node:url";
+import { checkPackList, packList } from "./packlist.js";
+import { readWorkspaces } from "./publish-tagged.js";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+
+let failed = false;
+for (const workspace of readWorkspaces(root)) {
+  if (workspace.private) {
+    continue;
+  }
+  const bad = checkPackList(packList(workspace.dir));
+  if (bad.length > 0) {
+    failed = true;
+    console.error(`${workspace.name}: disallowed files in tarball:`);
+    for (const path of bad) {
+      console.error(`  ${path}`);
+    }
+  } else {
+    console.log(`${workspace.name}: ok`);
+  }
+}
+process.exit(failed ? 1 : 0);

bin/packlist.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from "vitest";
+import { checkPackList, parsePackOutput } from "./packlist.js";
+
+describe("checkPackList", () => {
+  it("accepts the allowed shape", () => {
+    expect(
+      checkPackList([
+        "package.json",
+        "README.md",
+        "LICENSE",
+        "dist/src/index.js",
+        "dist/src/a/b.d.ts",
+        "dist/bin/bugc.js",
+      ]),
+    ).toEqual([]);
+  });
+
+  it("rejects src, tests, buildinfo, and dist/test", () => {
+    expect(
+      checkPackList([
+        "src/index.ts",
+        "dist/src/x.test.js",
+        "dist/tsconfig.build.tsbuildinfo",
+        "dist/test/helper.js",
+        "dist/vitest.config.js",
+      ]),
+    ).toEqual([
+      "src/index.ts",
+      "dist/src/x.test.js",
+      "dist/tsconfig.build.tsbuildinfo",
+      "dist/test/helper.js",
+      "dist/vitest.config.js",
+    ]);
+  });
+});
+
+describe("parsePackOutput", () => {
+  it("takes the last JSON array after script noise", () => {
+    const out = [
+      "yarn run v1.22.22",
+      "$ node ./bin/generate-schema-yamls.js",
+      "Done in 0.46s.",
+      "[",
+      '  { "files": [ { "path": "dist/src/index.js" } ] }',
+      "]",
+    ].join("\n");
+    expect(parsePackOutput(out)).toEqual(["dist/src/index.js"]);
+  });
+});

bin/packlist.ts

@@ -0,0 +1,40 @@
+import { execFileSync } from "node:child_process";
+
+const allowed = [
+  /^package\.json$/,
+  /^README[^/]*$/,
+  /^LICENSE[^/]*$/,
+  /^dist\/src\//,
+  /^dist\/bin\//,
+];
+
+const rejected = [/\.test\./, /\.tsbuildinfo$/];
+
+export function checkPackList(files: string[]): string[] {
+  return files.filter(
+    (path) =>
+      !allowed.some((re) => re.test(path)) ||
+      rejected.some((re) => re.test(path)),
+  );
+}
+
+export function parsePackOutput(stdout: string): string[] {
+  const lines = stdout.split("\n");
+  const start = lines.lastIndexOf("[");
+  if (start < 0) {
+    throw new Error("npm pack --json: no JSON array in output");
+  }
+  const parsed = JSON.parse(lines.slice(start).join("\n")) as {
+    files: { path: string }[];
+  }[];
+  return parsed.flatMap((entry) => entry.files.map((file) => file.path));
+}
+
+export function packList(packageDir: string): string[] {
+  const stdout = execFileSync("npm", ["pack", "--dry-run", "--json"], {
+    cwd: packageDir,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "inherit"],
+  });
+  return parsePackOutput(stdout);
+}